Built by 
About this software
About TopSwing - Golf Booking
TopSwing is an ASP.NET Core MVC (.NET 10) application with a SQL Server database accessed through parameterised ADO.NET, with no ORM. One installation serves a public website for each club or venue, including an 8-step tee-time booking wizard, and a role-based admin area at /admin. The admin side covers bookings, a tee sheet, payments, a page builder, a media library, CRM-style inquiries and leads, forms, SEO and settings. The public site is available in English and Arabic (/ar). The source includes unit, integration and Playwright UI test projects, plus Docker and manual setup guides. It ships with demo data and photos. The README states that QuestPDF is free only for organisations under USD 1M annual revenue, so larger buyers need a commercial licence. No mobile app is evidenced in the digest.
Why TopSwing - Golf Booking
What makes it better
than the alternatives
- 01
Concurrency-safe booking
Capacity is locked with sp_getapplock and re-checked inside the transaction. Submissions are idempotent, pricing is calculated server-side, and only verified webhooks mark a booking paid.
- 02
Generic admin engine
An EntityRegistry with EntityService and EntityHooks drives list, detail, edit, bulk, delete and CSV export screens. Permissions, location scope, validation and audit are enforced centrally.
- 03
Bilingual with RTL
Arabic is served at /ar with RTL layout, translated content overlays, hreflang and sitemap alternates. The admin can edit translations.
- 04
Hardened admin security
Server-side sessions with idle timeout, TOTP MFA, rate-limited login, password reset and invites, CSRF protection, an immutable audit log, and a CSP with no inline scripts.
- 05
Tested and documented
Unit, integration (including parallel double-booking) and Playwright UI tests are included. So are CLAUDE.md, a setup guide, and deployment, security and known-limitations docs.
Public booking
- 8-step tee-time wizard: course
- rate
- date
- live tee sheet
- players
- extras
- details
- review
- Dining and experience packages
- Confirmation with QR code and PDF
- Manage-my-booking link and self-service cancellation
- Optional external booking hand-off per location
Bookings & tee sheet
- Tee sheet view
- Staff bookings for phone and walk-in customers
- Payments and refunds
- Check-in
- Booking detail screens
Venue catalogue
- Locations and clubs
- Courses and tee-time rates
- Player types and add-ons
- Packages and price lists
- Memberships and members
Content & CMS
- Page builder with drafts
- publishing
- revisions and preview
- using about 41 section templates
- Homepage and navigation editing
- News
- FAQs
- promotions
- events and downloads
- Restaurants and menus with dietary and allergen filters
- Site search
- sitemap.xml and robots.txt
Media library
- Upload with type sniffing and a 20 MB limit
- De-duplication and alt text
- Replace file keeping the same URL
- Usage tracking
- with in-use files protected from deletion
- Private file downloads
CRM & forms
- Inquiries and leads
- Customer history
- Form builder with honeypot
- rate limits and optional CAPTCHA
- Newsletter management
- Safe file uploads
Security & access
- Roles and permissions with per-location scope
- TOTP MFA
- Session management
- Audit log
- Invite and password-reset flows
System & integrations
- Admin-configured integrations: Stripe
- SMTP
- Twilio SMS
- WhatsApp via Meta Cloud API
- Google Maps
- GA4
- Turnstile/reCAPTCHA
- Settings and SEO redirects
- Notification templates and log
- Background jobs for reminders
- scheduled publishing and retention
- System status and job-run views
Deployment
- Docker Compose stack with SQL Server 2022
- Windows/IIS and Linux setup guides
- Database schema and seed scripts
- Optional database auto-initialisation
- Serilog file logging
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| C# | — | — | Web, API, admin | 58.2% |
| C# (Razor) | — | — | Web pages | 19.3% |
| SQL | — | — | Database | 16.3% |
| CSS | — | — | Styling | 4.1% |
| JavaScript | — | — | Front-end | 2.1% |
| Shell | — | — | Scripts | 0.1% |
- Primary language
- C# 12 on .NET 10 (net10.0)
- Framework
- ASP.NET Core MVC 10 with Razor views
- Database
- SQL Server 2019 or 2022 (ADO.NET, parameterised SQL, no ORM)
- Authentication
- Cookie authentication with server-side admin sessions, role permissions, TOTP two-factor sign-in (RFC 6238) and password reset/invitation
- Licence
- Single-site
- Screens
- 100
- Database tables
- 60
- Supported languages
- English and Arabic (Arabic served at /ar/…, with a right-to-left layout using IBM Plex Sans Arabic and an RTL stylesheet)
- Browser support
- Modern evergreen browsers; UI tests run on Chromium via Playwright
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU |
| RAM | 4 GB RAM | 8 GB RAM |
| OS | Windows Server with IIS, or Linux, with the .NET 10 ASP.NET Core runtime and SQL Server 2019/2022 (Docker image: mcr.microsoft.com/dotnet/aspnet:10.0) | Windows Server with IIS, or Linux, with the .NET 10 ASP.NET Core runtime and SQL Server 2019/2022 (Docker image: mcr.microsoft.com/dotnet/aspnet:10.0) |
| Est. monthly hosting | $25 | $25 |
Runs the web app, SQL Server 2022 and a one-off database initialisation from docker-compose.yml. Evaluation over http://localhost:8080. ```bash cp .env.example .env # edit .env: set MSSQL_SA_PASSWORD, DEMO_PASSWORD (and SETUP_KEY for production) docker compose up -d --build ``` Then open http://localhost:8080 (admin at /admin). For production, put a TLS reverse proxy in front and set ASPNETCORE_ENVIRONMENT=Production.
Requires the .NET 10 SDK to build and a reachable SQL Server. Connection string goes in user secrets or environment variables (see docs/CONFIGURATION.md). ```bash cd "NET Project" dotnet build TopSwing.sln dotnet test tests/TopSwing.UnitTests dotnet publish src/TopSwing.Web/TopSwing.Web.csproj -c Release -o /app/publish dotnet run --project src/TopSwing.Web --launch-profile TopSwing.Web # local: https://localhost:7180 ``` Run the scripts in database/ with sqlcmd -I -f 65001 on an empty database (create-database.sql, schema.sql, then seed.sql or remove-sample-data.sql). Full steps are in HowToSetup.md.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
80/ 100
Automated audit score
✓ Passed the auditReviewer notes (4 minor)
Lockfiles present for every project, but package versions could not be inspected, so vulnerability status is unverified; database layer not verifiable: sql repositories and schema not in digest, only claims of parameterised sql; likely buildable with lockfiles and tests, but key build files were not visible to verify coherence; authz design looks solid, but most controllers could not be verified from the digest. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
